[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN0RQ6kabU6Z7jMXrWBE-JlcyY2Elg0wLzDQB-2rrWIg":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"a13a6c38-2bc5-4817-b8e7-265c8bc3f9c1","New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA","new-passkey-attacks-can-recover-synced-private-keys-or-bypass-phishing-resistant-cdcb04","Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abused a cloud-synced passkey system from malware already on the victim's machine, and used a","Three independent research efforts have revealed new vulnerabilities affecting passkey security, allowing attackers to bypass phishing-resistant MFA. These attacks do not break the underlying cryptography but instead exploit how systems handle authentication material. One method, demonstrated by SpecterOps, abuses signed authentication data exposed by Windows to impersonate privileged users in Microsoft Entra ID. Another, by Unit 42, targets Google Password Manager in Chrome, with a path to recover synced private keys. A third, by Dirk-jan Mollema, shows malware on a compromised Windows session can use hardware-bound Windows Hello for Business keys without re-authentication.","New passkey attacks bypass phishing-resistant MFA by reusing signed authentication material.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fnew-passkey-attacks-can-recover-synced.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjWKCkGCqH-c6Yaqkd_NnzFQijViu34tjAEsdl9tl2CmZLHL4m1rLhezO76zF6XFRTGS9Sr4R3jhMD7z15QV0BMqG948bjg8SoZb_j6HtQajd0PUDR8Tmw06GMqDwS6VhAtH-ZNtD06lzb9KMhJsHi-Vvkps0n6bl6C8n6rSBHCldBuc1cMczr30h11N-8\u002Fs1600\u002Fpasskeys.jpg","2026-08-10T12:25:04+00:00","2026-08-10T14:00:15.794114+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Windows Hello for Business","product",{"name":21,"type":19},"Google Password Manager",{"name":23,"type":19},"Chrome",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":26},"SpecterOps",{"name":30,"type":26},"Unit 42","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-34348","Information disclosure vulnerability in Windows Event Logging Service exploited in passkey attack.",[25,28,30],{"controls":61,"vendors":145},[62,90,119],{"slug":63,"name":64,"problem":65,"products":66},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[67,75,82],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":76,"vendor_name":25,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":91,"name":92,"problem":93,"products":94},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":133,"product_name":134,"url":135,"description":136},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[146,152,154],{"slug":147,"name":148,"logo_path":149,"roles":150},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[151],"affected",{"slug":76,"name":25,"logo_path":77,"roles":153},[151],{"slug":112,"name":113,"logo_path":114,"roles":155},[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":174},"passkey-attacks-bypass-phishing-resistant-mfa-without-breaking-cryptography","Passkey Attacks Bypass Phishing-Resistant MFA Without Breaking Cryptography","Three independent research efforts revealed that passkey security can be undermined not by breaking cryptography, but by exploiting how authentication material is handled, synced, or exposed at the system level. Attackers can abuse signed authentication data in Windows to impersonate privileged users in Entra ID, extract synced private keys from Google Password Manager, or leverage hardware-bound keys from a compromised Windows session without re-authentication. This matters because organizations that deployed passkeys specifically to achieve phishing resistance may now have a false sense of security. The attacks highlight that strong cryptographic primitives are only as secure as the ecosystem—OS, browser, and identity provider—that surrounds them.",[162,163,164,165,166,167,168,169,170,171,172,173],"CIS Control 6: Access Control Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-63B: Digital Identity Guidelines – Authenticator Assurance","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST IA-5: Authenticator Management","NIST IA-8: Identification and Authentication (Non-Organizational Users)","NIST SI-7: Software, Firmware, and Information Integrity","MITRE ATT&CK T1552: Unsecured Credentials","MITRE ATT&CK T1556: Modify Authentication Process","ISO\u002FIEC 27001 A.9.4: System and Application Access Control",{}]